registry / AI-agent control-surface risk / triflux / 10.55.1

triflux@10.55.1

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall hook activates setup that changes agent configuration without obtaining consent, matching the install-time control-surface policy. The observed writes support blocking even though the configuration is for Triflux features.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing triflux through npm, which runs its postinstall script.

Impact

The package can alter agent behavior and configure commands to run in agent sessions.

Mechanism

The setup flow applies status-line, agent-team, and remote-control settings and persists changes; it also writes managed Codex hooks when that setup path reaches the hook installer.

Policy narrative

During npm postinstall, the package runs setup without an interactive consent prompt. The setup flow modifies Claude settings and can write Codex hook configuration, establishing an install-time AI-agent control-surface mutation.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjs~/.claude/settings.json~/.codex/hooks.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 91.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/setup.mjs automatically on postinstall.
The installed package invokes runDeferred during postinstall; its setup flow does not require an interactive terminal.
runDeferred reads and changes Claude settings through applyStatusLine, applyAgentTeams, and applyRemoteControl, then persists changes.
The setup path also invokes Codex hook setup, which writes hooks.json when its managed hooks change.
The source therefore establishes unconsented install-time changes to AI-agent configuration.

Evidence against

The setup functions use package-owned Triflux integrations, and Codex hook installation is separately consent-gated in the interactive setup flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Source & flagged code

13 flagged

package.jsonView file

Lines 1-37json

2 "name": "triflux",

3 "version": "10.55.1",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-setup": "bin/tfx-setup.mjs",

11 "tfx-doctor": "bin/tfx-doctor.mjs"

12 },

13 "engines": {

14 "node": ">=22"

15 },

16 "scripts": {

17 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 },

19 "dependencies": {

20 "@iarna/toml": "^2.2.5"

21 },

22 "files": [

23 "adapters",

24 "bin",

25 "config",

26 "skills",

27 "!skills/tfx-workspace",

28 "hooks",

29 "hud",

30 "scripts",

31 "!scripts/__tests__",

32 "hub",

33 "docs/assets/logo-dark.svg",

34 "docs/assets/logo-light.svg",

35 "docs/assets/social-preview.png",

36 "docs/assets/social-preview.svg",

37 "README.md",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import { mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";

bin/triflux.mjsView file

Lines 1355-1395javascript

1355 summary.push({ item: "HUD statusLine", status: "✅", detail });

1356 } catch (e) {

1357 throw createCliError(`settings.json 처리 실패: ${e.message}`, {

1358 exitCode: EXIT_CONFIG_ERROR

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/tfx-live.mjsView file

1#!/usr/bin/env node L2: import { execFile } from "node:child_process"; L3: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

bin/triflux.mjsView file

1375L1376: // ── psmux 기본 셸 자동 수정 (cmd.exe → PowerShell) ── L1377: if (process.platform === "win32" && which("psmux")) {

High

Shell

Package source references shell execution.

Findings

1 Critical8 High6 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/tfx-live.mjs

HighShellbin/triflux.mjs

HighExternal Ai Agent Control Surface Mutationscripts/mcp-check.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/ensure-codex-hooks.mjs

HighTrigger Reachable Persistencescripts/setup.mjs

HighRuntime Package Installbin/triflux.mjs

HighSemantic Analysis Limitedhub/team/headless.mjs#virtual:normalized:round1

MediumDynamic Requirebin/triflux.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to triflux@10.55.1.

See all versions of triflux for other recorded verdicts.

Avoid installing triflux@10.55.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 03:50:47.600Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code